Blocking scripts until consent

A cookie banner is only compliant if trackers actually wait for consent. Consentful keeps each tracking script inert until the visitor allows its category, then starts it — no page reload needed.

Option 1 — add scripts in the editor (recommended)

On the Scripts tab, add each tracker's URL or code and choose its category. Then delete the original tag from your site's head, theme or custom code, or it will still run before consent.

Option 2 — mark scripts in your site's code

Change the script's type to text/plain and add a category. The browser won't run it until Consentful activates it.

<!-- Before -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
 
<!-- After: runs only once "analytics" is allowed -->
<script type="text/plain" data-cc-category="analytics"
        data-cc-src="https://www.googletagmanager.com/gtag/js?id=G-XXXX" async></script>
 
<!-- Inline code works the same way -->
<script type="text/plain" data-cc-category="marketing">
  fbq('init', '1234567890'); fbq('track', 'PageView');
</script>

Use the category ids from the Categories tab: analytics, marketing, preferences, or your own.

Iframes and embeds

Turn on Block embeds until consent on the Scripts tab and common embeds (YouTube, Vimeo, Google Maps, TikTok, Instagram, X, Spotify…) are handled for you.

For anything else, or to be certain an embed never contacts its provider before consent, put the address in data-cc-src instead of src and add a category. Consentful shows a "Load content" placeholder until that category is allowed:

<iframe data-cc-src="https://www.youtube.com/embed/VIDEO_ID"
        data-cc-category="marketing"
        width="560" height="315" allowfullscreen></iframe>

This form works whether or not automatic embed blocking is on.

What about Google tags?

Google Analytics, Google Ads and Tag Manager also respect Google Consent Mode v2. Consentful sets all their signals to denied before they load, so even if a Google tag runs early it won't set advertising or analytics cookies until consent.

Check it's working

Open your site in a private window with your browser's developer tools on the Network tab. Before you choose, requests to tracker domains (e.g. connect.facebook.net, static.hotjar.com) should not appear. After Accept all, they should.